Until this Nono tool gets a supply chain attack and happily ships all your Azure credentials somewhere they aren’t supposed to be, then starts mining Monero or something.
LiteLLM is frequently used in roughly the same scenario - trading virtual LAN-only keys for real ones as it relays requests to the inference providers.
> LiteLLM is frequently used in roughly the same scenario - trading virtual LAN-only keys for real ones as it relays requests to the inference providers.
LiteLLM isn't a sandboxing tool so it just can't perform as much risk reduction even when everything is working as intended.
And what nono adds over sandbox-exec is a uniform interface across platforms and some policy management tools. You can impose the same restrictions via the OS built-in mechanisms yourself via Seatbelt or a built-in interface like sandbox-exec. You can also combine an OS-level sandboxing tool like nono, zerobox, Anthropic's srt, Seatbelt, landrun, Bubblewrap, Fence, etc., with a VM-based one like Docker's sbx, smolvm, krunvm, microsandbox, or Shuru. So now you need two simultaneous supply chain attacks in unrelated projects to line up just right at the same time.
"Eventually you have to trust some part of your security stack" is neither particularly interesting nor evidence that there's no way to defend against supply chain attacks. Even if you only have one sandboxing tool and it's OS-level rather than VM-based, that becomes a single part of your stack that you can give special attention to in evaluating updates in a way that LiteLLM can't be.
There's also just the empirical fact that at this point, trusting LiteLLM's maintainers to lock down their release pipelines looks foolhardy. This is the second supply chain attack they've had in 7 months. It's absolutely wiser to choose a sandboxing tool you like, audit it to examine its release pipelines, code signing requirements, attestation strategy, and whatever else, then put LiteLLM inside that tool's sandbox than to just thow your hands up and say "I gotta trust something, so it might as well be LiteLLM!". Maybe nono ain't it either, idk. I'm still experimenting to figure out how I want my setup to work.
But I think neither the defeatism nor the relativism in this thread are very compelling.
> NDs have a hard time understanding the shared context of their audience
Or they understand that this “shared context” is a myth that doesn’t exist in reality. Plenty of situations where everybody just nods “yea, right” and then walks away with a different idea because they’ve been looking at it from a different perspective/set of assumptions.
The issue is that you've got to build shared context before people can follow an unstructured dump of everything in your brain. You have to tell a story that makes sense. Also, ideally you figure out how to filter out the stuff that other people simply don't need to know. It is not easy, but it is a skill you can learn.
How ND of you! There is a difference because the when the ND person misses the mark they get reactions of confusion. What you're talking about has a huge amount of instinctual social detail behind it and knowing what kind of 'yeah right' and seeing how your audience received it is part of the game.
What game with a huge amount of detail are you talking about?
For my experience, kinds of “yeah right” are just nonverbal signals. People who primarily communicate by text may miss those (it’s literally a different language), and so may folks who tend to get hyper focused on their thoughts so they lose track of their peer (so they stop seeing those details). What confuses me here is that it’s not something with a ton of detail - just a bunch of signals and their meanings that people are expected to know and recognize. There sure are groups with insanely deliberate rules and complex signaling, but that’s for extra geeky folks, not any norm.
Even if I’m just missing the complexity… I don’t see: why not being able to do so would tend to steer someone into hyper-verbosity? Especially when plain old conformance is more than enough to explain it all no less plausibly?
To be honest, I dunno about neurodivergent experience, I’m just a plain old ret^Wdumbass. I think that ND people know there’s - generally speaking - no secret and unspoken NT context game they’re not privy to. There could be something I’m not seeing or even knowing. And that’s exactly why - I think - nuances and details are sometimes important, not because brains can be wired different ways. My impression is that if someone writes any long (for the type of communication) form on some stuff they care about, they’re supposed to get into details and nuances, irrespective of author’s tendency for cognitive or processing quirks.
So, sorry
- not to invalidate if this is a personal experience, but… while I won’t dispute ND correlation, how do you know that explanation?
... are you going to accuse his 2 sentence post of being hyperverbose?
> huge amount of instinctual social detail behind it and knowing what kind of 'yeah right' and seeing how your audience received it is part of the game.
Most people's instincts on the matter lead them astray. They seem to spend their life hallucinating that other people said or thought things that they didn't. Functional assumptions, but wrong. With a predictable consequence that sociopaths have an easy time ending up in charge if they feel like it, because people relying on their instincts just make too many social mistakes.
You are also missing the point, being ND doesn't mean you are hyper verbose, always. This overall sour grapes about how NTs have social instincts is a typical development of autistic people over the years, which you are also exhibiting.
It's not an accusation, but a mirror to help them potentially realize something, so they don't suffer so much through life so. When you realize what is happening, it helps release a lot of suffering in a person's life. The sour grapes is not helpful, NT social instincts are not going away and it's better to understand and work with the world than to be upset that rain happens sometimes and it just should never exist!
NT social instincts does not mean the person is super effective socially and everything else, but it's a very useful tool if they decide to develop their social skills.
And considering typical WAN latencies of 20+ ms, what’s the expected inference rate, 1 token per month?
Maybe I did something wrong or unaware about the tricks to make it fast, but last time I tried to play with exo and distribute processing over a few home LAN computers to see if I can run models that don’t fit my 3090, the penalties were brutal.
I don’t know about my sense of right and wrong (some shit’s pretty fucked up in my head for sure), but back in the day, before the war, it was possible to work remotely for for foreign companies and earn good money without selling one’s soul to the devil.
When Crimea was annexed the writing on the wall was clear, so I made The Grind a priority, got fairly close to the top 10% (the real gap is corruption and having connections; net worth is something you have one day and lose the next one), and was able to leave with enough cash to keep me more than just afloat. And almost everyone I knew who was able to outsource their skills and wasn’t blind to what was happening, did the same thing: grind, save, move, settle down, live.
And then, when the war escalated into a whole different phase, I know some folks left Russia with a lot less than what I had - not piss poor but nowhere close to the top 10%. They had it a lot rougher, but the danger to their wellbeing and lives was more immediate. So I know you’re wrong about wealth being a requirement for leaving - it’s a huge boon that makes it a lot easier, but it’s certainly not a hard requirement.
So the obvious move is that marketing materials sing how it’s super private, while actual steganography encodes everything to uniquely identify you. If someone discovers something wave it away (and crack down on pesky whistleblowers), eat the fines if the worst happens.
- Apple. Least of all, but still fits: PR pushes double on privacy, but their interests are not their end-users, they just happen to align on some points as they’re not in adtech business.
- Microsoft. The classic case for getting slaps on the wrist, Gates said one thing he’d do differently is sending lobbyists earlier, or something to that effect, didn’t he?
- Amazon, Netflix, Uber, Airbnb and many more are still all variants of the same story. It’s not a lie that everyone nowadays expects most megacorps to fuck people over if there’s money in that.
That’s the Order of “Feel for It Again”, with oak leaf clusters already, no? Something’s cursed in this industry, every company that sells software to individual people ends up the same when they become gigantic and endowed by wealth and power, even if they were decent in their early days. They all become those blind heralds of paperclip^W shareholder value(tm) maximizers, and I’m finding myself struggling looking for an exception.
Am I to believe this time it’s going to be any different, to set those - not baseless, I’d say - cynical expectations aside? Any signs there’s a change?
So, I disagree - it’s obvious, given the ad-adjacent end-user-facing megacorp context, OpenAI is right there. Cynical - sadly so, yes. But I’m sure it’s obvious: the idea of such a possible direction comes up pretty quickly and reliably so.
Most likely both. Just recently Russia had already contained the embarrassment of announcing there was a foot-and-mouth disease in cattle (so they don’t have to declare even a sporadic outbreak), but they also eradicated all the cattle to both contain and cover it up. Most likely, the same thing - containing, but under a different (less unsavory-sounding) pretense.
Jujutsu is perfect for that - you create new changeset upfront, providing message at the same time (which can be later amended as needed). Feels so much more logical to declare the topic first, rather than come back to some accidentally uncommitted changes and wonder what was doing there.
"Topic" is usually covered by branch name. Commit message goes with a set of code changes, it feels more logical to me for the message to describe the actual code as it was written (as it might have changed from the idea phase).
In Git, but workflows in Jujutsu aren't necessarily the same as in Git.
Branches for example aren't named in Jujutsu. You can bookmark them which gives them a name in some sense... but that's an optional thing you can do, often as a concession to centralized Git interoperability.
So in this case the parent to your post isn't thinking about it wrong given the context and such workflows have their advantages I've found.
LiteLLM is frequently used in roughly the same scenario - trading virtual LAN-only keys for real ones as it relays requests to the inference providers.
reply